MOSS supports four more open source projects in Q3 2016 with $300k

Freenet is facing this. They got a 25k donation from duckduckgo and for the last couple of months debate on how to spend it, whether the previous paid developer gets to continue, etc. They're running a poll at the moment to decide on projects and priorities. The developer mailing list is the details.

I think the convention is usually that the funds are used to pay developers to work on the project full-time.

There are different types of funding provided by Mozilla. We participated in the Secure Open Source (SOS) Fund and that was pretty straightforward. Mozilla pays a security firm to audit an open source codebase and then report their findings to the authors. There is little to argue over compensation-wise.

Mozilla plays a small but valuable role in shepherding fixes that assists any team unprepared to deal with such an audit report. I think having Mozilla broker the conversation helps with framing the report too: it communicates that the project is important enough to warrant such an interaction and that this was done to help, whereas I think that communication directly from a security firm is more typically viewed with suspicion or denial.

Hypothetically, the target of the assessment not being paid to fix the discovered issues could present a problem. I have never seen compensation to fix security bugs in practice. In some ways, it feels wrong since the compensation might go up based on the number or severity of bugs found, in essence a reward for insecure code. If you're maintaining a critically important project, security fixes seem like the cost of entry, not something that needs an extra push.

In my opinion, it is better to earmark funds to developers for strategic improvements anyway (eg. sandboxing, verification, privilege separation, etc). The Foundational Technology Fund from Mozilla requires a "clear and current project goal" [1], so if they funded a security improvement it looks like it would follow this approach [2].

In our experience, working with zlib was a pleasure. They fixed nearly all of our issues before we even noticed and we had a detailed, technical discussion about one of them. I credit Gervase at Mozilla for assisting with that and I would certainly work with the whole team there again.

[1] https://wiki.mozilla.org/MOSS/Foundational_Technology#Projec...

[2] https://blog.mozilla.org/blog/2016/06/22/mozilla-awards-3850...

I think they've been very clear in their actions. Thunderbird is dead. RIP.

Close! tis-interpreter requires inputs to drive it, so we fed it inputs that the CRS generated, that AFL generated, and some existing test cases. tis-interpreter found 4 bugs and clang found 1.

> This doesn't necessarily mean CRS is bad, it may just mean that there are no bugs of the classes CRS finds in zlib.

Yes, exactly! This is why we included so much detail about coverage in the report. Basically, "stop looking for these kinds of bugs in these places, focus your efforts elsewhere in the code."

Most modern tech companies are contributing to open source, via both sponsorship and developer time. It would be great if they did more of course.

The ZAP project lead, Simon Bennetts, works for Mozilla: https://www.owasp.org/index.php/User:Simon_Bennetts

I believe Mozilla pays him to spend a substantial amount of his time (like 50% or more) working on ZAP.